How the sticker scam works
- Someone prints a QR code that opens a page they control, made to look like the real one.
- They stick it over the genuine code on a parking meter, a charger, a poster or a table tent.
- A person in a hurry scans it, sees a familiar payment page and types their card details. Sometimes the page asks them to install an “app” instead.
Nothing on the sticker tells the person scanning that it isn’t genuine. The phone’s preview, when there is one, shows a short address that is easy to misread.
Where it happens
Any printed code that leads to a payment and sits somewhere unattended: parking pay stations and signs, public chargers, menus and pay-at-table codes, posters, invoices and letters. In the United States, the FBI warned in January 2022 (FBI notice, opens in a new tab) that criminals tamper with physical QR codes. The Federal Trade Commission reported in December 2023 (FTC alert, opens in a new tab) that scammers covered the QR codes on parking meters with their own.
QR codes also arrive by email and by post. A code in a message asking you to “confirm” a payment or a delivery deserves the same suspicion as a link.
Where signed codes help
- When a business prints QRalo-signed codes, every genuine code opens a page on qralo.com with who signed it, the full destination and the printed label, such as a meter number.
- If someone edits a code’s content, for example to change the destination, the signature check fails and the page says the code can’t be verified.
- If a genuine code is compromised, the issuer can revoke it. The next person who scans it sees that it was withdrawn.
- Destinations go through automated link checks when codes are created and scanned. They use public lists of known phishing and malware sites where available, plus simple rules. A brand-new phishing page can still get through.
What a sticker still gets past
- A sticker over a genuine code never opens qralo.com. Someone who scans it with a normal camera, and doesn’t expect a check page, goes straight to the copy.
- People who know the real code always opens qralo.com, with the operator’s name and the meter number, notice when a code skips that page. That is what the signage is for.
- A blue result says nothing about whether a website is harmless. QRalo isn’t antivirus for your phone.
- Anyone can open a QRalo account and type any name. Nobody else can verify your domain, and without it the page marks the name as not verified and shows no blue check.
What to do if you find a fake sticker
If you’re the one scanning
- Don’t pay through it. Pay at the machine, at the counter or in the operator’s official app.
- Tell the operator or the business. Use a contact printed on the machine or found on their official website, never one from the sticker.
- If you’ve already paid, call your bank straight away, then report it to the police.
- Not sure? Open qralo.com/scan and scan the code. An ordinary code’s address shows as text and doesn’t open. The verification guide explains each result.
If it’s on your equipment
- Photograph the sticker if you plan to report it, then remove it.
- Check nearby machines and signs. Fake stickers rarely come one at a time.
- If you use QRalo, revoke any genuine code that may have been tampered with and print a replacement.
- Warn your customers where they pay, and report the fake website to the police.
Advice for businesses
- Sign the codes people pay through: parking, charging, menus and pay-at-table.
- Give every code a printed label (meter, charger or table number) and put the same label in the code, so people can match the two on the verification page.
- Print one line next to the code: “Scanning opens qralo.com first”. It turns the check into a habit.
- Verify your website’s domain, so the verification page shows it with a blue check.
- Point codes to your own website when you can. Revoke and reprint as soon as a code looks tampered with.
Read more: what signed QR codes are, parking and payment meters, EV charging and restaurants.